LoginSign Up
← Back to all sparks
F

Froxlor

DEVOPS
Velocity5.0

Server administration and hosting control panel

froxlor.org ↗

Froxlor 2.3.17 fixes nginx serving PHP source as plain text

hosting-panelopen-sourcesecurity-fixesnginxmulti-tenant
◆Current state
Froxlor is an open-source server administration panel. Security release 2.3.17 lists more than a dozen fixes: nginx served PHP files as plain text in folders with directory options, directory protection missed PHP and subfolders, symlinks in customer paths were not fully resolved, and several admin pages lacked permission checks. Customer data exports now stage outside the customer's web root. It follows 2.3.14 to 2.3.16, which mixed security fixes with PHP 8.5 compatibility.
◆Where it's heading
Froxlor's releases are now dominated by security audit findings, and the notes are detailed. The fixes cluster around nginx config generation and per-customer permission scoping, the parts of a hosting panel where one tenant can reach another.
◆Prediction
More point releases from the same audit are likely, especially on nginx and permission checks; no feature release is signalled.

◆Recent moves

  1. 6d ago

    froxlor security release 2.3.17

    The largest security batch in this window, including nginx serving PHP source as plain text and directory protection gaps that could expose customer code or credentials. Anyone running Froxlor with nginx should update.

    View source ↗
  2. 25d ago

    froxlor bugfix release 2.3.16

    PHP 8.5 compatibility, multi-line hosting plan descriptions and a fix so the traffic listing respects a customer's hidden-traffic option. Mostly compatibility upkeep, with one small permission fix.

    View source ↗
  3. 1mo ago

    froxlor bugfix release 2.3.15

    A bug-fix release for database error handling, MySQL user host checks, nginx body-size limits and SSH keys on shared FTP home directories. Routine maintenance.

    View source ↗
  4. 2mo ago

    froxlor bugfix release 2.3.14

    Four security fixes covering theme allowlisting, control characters in FTP members, permission checks on server and cron reads, and mail template scoping. Security work arriving inside a regular bugfix release, with notes this time.

    View source ↗
  5. 2mo ago

    froxlor bugfix release 2.3.13

    Tagged a bugfix release, but the body is only a compare link to 2.3.12, so what changed is not visible from the feed. The same shape as 2.3.12 and 2.3.10 before it.

    View source ↗
  6. 2mo ago

    Froxlor bugfix release 2.3.12

    Another bugfix tag published with a bare compare link and no described change.

    View source ↗